DSA-3584-1 librsvg - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3584-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

librsvg2 Denial of Service Vulnerability

librsvg2 is an SVG rendering engine written in C. It can be used to render a number of SVG files. A security vulnerability exists in librsvg2. An attacker can exploit this vulnerability with SVG files to cause stack resource consumption and crash the application...

Slack: Executing scripts on slack-files.com using SVG

Impact Although slack-files.com is a sandbox domain, there are many ways to gain the victim's trust during phishing attack. For example, an attacker might render a fake log-in form with "You need to sign in to see this file" message and trick users into handing out their passwords. Steps to...

MediaWiki < 1.19.24 / 1.23.9 / 1.24.2 Multiple Vulnerabilities

According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities : - An input validation error exists related to handling API errors that allows reflected cross-site scripting attacks. CVE-2014-9714, CVE-2015-2941 - An input...

CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

Mozilla Thunderbird < 31.5 Multiple Vulnerabilities

Binary data 8676.prm...

CVE-2014-3755

The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service hang and resource consumption via a local file reference in an 1 image tag or 2 XML stylesheet in an SVG file...

Fedora 19 : mediawiki-1.23.4-1.fc19 (2014-11582)

bug 69008 SECURITY: Enhance CSS filtering in SVG files. Filter elements; normalize style elements and attributes before filtering; add checks for attributes that contain css; add unit tests for html5sec and reported bugs. - bug 65998 Make MySQLi work with non-standard socket. - bug 66986...

Fedora 21 : mediawiki-1.23.4-1.fc21 (2014-11717)

bug 69008 SECURITY: Enhance CSS filtering in SVG files. Filter elements; normalize style elements and attributes before filtering; add checks for attributes that contain css; add unit tests for html5sec and reported bugs. - bug 65998 Make MySQLi work with non-standard socket. - bug 66986...

CVE-2014-7199

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

[SECURITY] [DSA 3036-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3036-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 26, 2014 http://www.debian.org/security/faq -...

CVE-2014-3160

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...

Design/Logic Flaw

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...

CVE-2014-3160

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...

CVE-2014-3160

Removed by vendor...

CVE-2014-3160

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...

Fedora 19 : mediawiki-1.21.11-1.fc19 (2014-7805)

bug 65839 SECURITY: Prevent external resources in SVG files. - bug 66428 MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. Note that Tenable Network Security has extracted the preceding description block directly from...

Fedora 20 : mediawiki-1.21.11-1.fc20 (2014-7779)

bug 65839 SECURITY: Prevent external resources in SVG files. - bug 66428 MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. Note that Tenable Network Security has extracted the preceding description block directly from...